Mustang

I guessing if your adding a TCP-IP Printer then your printing directly to the printer and not via a print server? The print will still map if Windows already has a driver for that printer that it trusts or its using a generic Type4 driver. So the user is not installing any new drivers. You can check the printer driver running the following Powershell command get-printerdriver

I think there seems to be a bit of confusion around this. Setting the “Users can only point and print to these servers” and “Package Point and Print - Approved servers” group polices will not stop the UAC prompt when mapping a printer and allow non admins to map network printers that require drivers to be installed. This does not matter if the Printers are deployed by group policy, group policy preferences, script or mapping the manually, setting these polices have no effect and just define the list of servers where users are allowed to map printers from. These group polices should be used to help mitigate some of the security risk if you decide to set the RestrictDriverInstallationToAdministrators registry value to 0 (BAD IDEA) and protect against the newly announced CVE-2021-36958 for which there is currently no patch. I have tried installing our current Type 3 printer drivers locally using pnputil or add-printerdriver as recommend by Microsoft but this did not work for me, non admins still can’t map network printers that use Type 3 drivers. The only way I can allow non admins to map a network printer is by updating to the newer Type 4, in the case of the HP Universal driver I had to stop using it as I can’t find a Type 4 driver and switch to model specific driver.

We have been running a small pilot of about 40pcs and 60Macs for about 2 years but never got chance to expand on it. Haven't had a single issue with it but we don't use WOL All the machines are dumped in an unauthorised vlan but once the OS starts and they authenticate they moved into the normal data vlan. Biggest issued we faced were Our IP phones only support Mac authentication and the radius server doesn't, it can also only put devices in an untagged vlan, so the phones ended up in the data vlan with no QOS. You also need to tell the switch that multiple device can be connected to a port if the phone has a pass through port. Windows Depoyment with MDT, you need your pxe server, DNS available on the unauthorised vlan. you have to build a custom pe with 802.1x support and a custom script that authenticates the PE. Once that has happened you can deploy your OS/image to the machine but when the machine reboots you will need another script that runs during the OOBE to authenticate again so you can carry on the deployment and access the MDT share. HP Printers, never bothered as it looked a right mess and they are already on a restrictive vlan. We also currently use peap authentication which means you can't run credential guard and other newer security features on windows 10, so the plan is to swap it to eap-tls before we update to 20H2

This might have worked in terminal networksetup -setwebproxy "Wi-Fi" proxy1.domain.com 8080 networksetup -setsecurewebproxy "Wi-Fi" proxy1.domain.com 8080 networksetup -setwebproxystate "Wi-Fi" on networksetup -setsecurewebproxystate "Wi-Fi" on

Don't you need any data points with your room redesign? For a brand new IT room I would expect to pay between 2K and 6K depending on requirements Number of electrical sockets Number of data outlets New/extra trunking and trunking type Modifications to the distribution board New electrical ring Distance from data cabinet Time scale

I would highly recommend JPR Engineering Security Contractors Staffordshire They are based in stoke but will travel all over the country, they can do power, data, alarms, cctv, aircon etc. A number of Universities, Colleges and Schools without any issues.

you said when you do it manually it only works via DFS, has that changed or do you mean something different than using CMD+K ?? What version of macOS are you using?

What are your share permissions and acls?

What are you using the recovery partition for?

Can you do basic things like ping your file server, look it up in DNS, manually mount the file share via the netbios name or the fqdn, mount another file share on a different server etc

This is bad advise do not use DeployStudio for deploying High Sierra, Apple does not support imaging APFS volumes and any Mac with a T2 chip cannot be net booted. As @Arthur said Imaging is Dead and you need to look into thin imaging/MDM (basically application and settings deployment)

You haven't said if students can access there user area in the Mac suite? What happens if you disconnect the mixing desk and give the studio Mac no option but to use your network.

Curious to know how this would help?

As you have found out there is clearly something wrong with how you had your ACLs configured. Have you checked your staff users shares and shared areas too? chances are if one was configured wrong then others might be as well. Also redirecting Appdata to your network storage is definitely going to slow down all application that use the redirected appdata, especially Adobe applications. Lastly what are you trying to achieve by blocking access to these folders?? as you have seen even builtin windows applications can bypass the restrictions you have in place and I know of a number of applications you can download which will do the same without being installed. As long as your ACLs are correct you shouldn't have anything to worry about.

if you're allowed you could post the config of the switches and we can try and help?

I would never recommend a MDM solution for 10 to 20 static Macs, it just isn't cost effective. Realistically how often do the settings change? once or twice a year at most, its pretty much set and forget so why pay for a MDM? Apple profiles are every bit as powerful as mcx settings were in workgroup manager, they just aren't as easy to configure. Also a mistake I often see is that people try and configure or lock down Macs as they would with windows, once you start thinking about how Apple has designed the device to be used (1 to 1 etc) then managing them becomes a little easier. What settings are you looking to actually configure and lockdown??

where does the 0.0.0.0/0 route point to? are you redistributing connected and static routes into ospf?

Yes I also think that should work. When you enable OSPF on HP switches it defaults to load balancing 4 links (IP Load Sharing).

By default the PE can't contain every driver so this will happen from time to time. Download the drivers for your network card and copy them to a usb stick Insert the usb stick and PXE boot the machine into the WDS boot image, when it errors press shift+f10 to open the command prompt At the command prompt run ipconfig to verify that you don't have an ip address. now type "drvload.exe d:\pathto\driver.inf" it should complete without errors now type ipconfig and verify you now have an ip address. If you still don't have an ip address repeat with different drivers. make a note of the driver that worked, you will need to add this to your WDS boot image. you can google how to do this part as i can't remember, its been a few years.

It may have worked because you were syncing over AFP which i have never tried. Yes i have also been using symbolic links for the Desktop, Documents etc for years so i have no need for sync. How are you enforcing the file restrictions? using a windows file server? Only asking because you need to make sure the 5300 is up to the task cpu wise and you have enough disks for the extra IO. Other than that they are rock solid if a little dated and that horrible java web interface We currently use a 5300 as a nas for all our students shares but hopefully when it comes up for renewal we will switch back to a windows front end with iscsi storage on a new vnx.

I would steer well clear of Home Sync (if thats what your actually using) i have never seen it work reliably and the online Apple communities advises against using it. I also believe its deprecated in the next version os Mac OS. Any reason you don't want to use the AD home folder path? our students love being able to swap between mac / pc and being able to access there files from the same location. Which model is your VNX? and is it fully unified or just file only or just block only?

You haven't said why you want the Macs in there own vlan, if everything else is in a single vlan why not put the macs in there as well? seems to me like you don't fully understand why your doing it. If you really do want to segregate you should look at doing it for Servers, Phones, Client Access, Printers, Private WiFi Client Access, Guest WiFi Client Access, CCTV etc

You should look into LAPS instead https://technet.microsoft.com/en-us/library/security/3062591.aspx

You should try to avoid at all costs from wrapping installers inside .cmd/batch files. MDT looks for the exit code from the running program before it continues to the next item, with a .cmd/batch file MDT sees the exit code from the batch file and not the installer that it was running, so it may continue even if the installer failed. You should always use the silent switches for an installer if possible and then run a separate script/step to clean up the mess that the installer leaves, that way if the script fails you are only left with messy shortcuts and start menus etc and not half installed programs.

Apple's Macs use BSDP and don't use option 66,67. Option 66,67 are not required for or even supported for PXE booting and you should not be using those options for PC clients, adding ip helpers is the supported method.